The Demon Shamoon, Eraser of the Gulf

Legend

In August 2012 it struck Saudi Aramco, rendering around 30,000 workstations unusable and showing the image of a burning flag on screens. New versions returned against Gulf targets in 2016 and 2017 and against Italy's Saipem in 2018. It asked no ransom: it only wanted to destroy.

Exorcism

Cast it out with offline backups and a plan to rebuild workstations fast. Protect and monitor privileged accounts, since that is how it spreads.

Technical record

Also known as: Disttrack
Circle: Circle IV · Destroyers (wipers) · Circle V · State espionage
First seen: 2012
Status: Dormant
Works: The Scourge of Shamoon

A destructive wiper used in August 2012 against Saudi Aramco, where it rendered around 30,000 workstations unusable and displayed a burning-flag image. New versions struck Gulf targets in 2016-2017 and Italy's Saipem in 2018. The attacks are associated with Iranian state-linked actors.

Sources: attack.mitre.org · attack.mitre.org · MITRE ATT&CK reference S0140